signature=5f2f3535f49c96be762e1500813df4e8,Windbg命令系列---!dh(显示PE头信息)

!dh扩展指令显示指定模块Image的头信息。相当于一个弱化的dumpbin工具。

语法

!dh[Options]Address

!dh -h

参数

Options以下任一选项：

-f显示文件头。-s显示节头。-a显示所有头信息.Address指定Image的十六进制地址。-h在调试器命令窗口中显示此扩展的一些帮助文本。

DLL

Windows 2000

Dbghelp.dllKdextx86.dllNtsdexts.dll

Windows XP and later

Dbghelp.dll

备注

!lmi扩展命令从Image头中提取最重要的信息，并以简明的摘要格式显示。而!dh更详细。

例子

lmvm clr

Browse full module list

start    end        module name

153a0000 15a3d000   clr        (deferred)

Image path: C:WindowsMicrosoft.NETFrameworkv4.0.30319clr.dll

Image name: clr.dll

Browse all global symbols  functions  data

Timestamp:        Sat Apr 12 09:25:50 2014 (5348961E)

CheckSum:         0069CE03

ImageSize:        0069D000

File version:     4.0.30319.34209

Product version:  4.0.30319.34209

File flags:       8 (Mask 3F) Private

File OS:          4 Unknown Win32

File type:        2.0 Dll

File date:        00000000.00000000

Translations:     0409.04b0

Information from resource tables:

CompanyName:      Microsoft Corporation

ProductName:      Microsoft® .NET Framework

InternalName:     clr.dll

OriginalFilename: clr.dll

ProductVersion:   4.0.30319.34209

FileVersion:      4.0.30319.34209 built by: FX452RTMGDR

PrivateBuild:     DDBLD354

FileDescription:  Microsoft .NET Runtime Common Language Runtime - WorkStation

LegalCopyright:   © Microsoft Corporation.  All rights reserved.

Comments:         Flavor=Retail

0:031>!dh -f 153a0000

File Type: DLL

FILE HEADER VALUES

14C machine (i386)

5 number of sections

5348961E time date stamp Sat Apr 12 09:25:50 2014

0 file pointer to symbol table

0 number of symbols

E0 size of optional header

2122 characteristics

Executable

App can handle >2gb addresses

32 bit word machine

DLL

OPTIONAL HEADER VALUES

10B magic #

11.00 linker version

639000 size of code

5DE00 size of initialized data

0 size of uninitialized data

CD8F8 address of entry point

1000 base of code

----- new -----

0f2b0000 image base

1000 section alignment

200 file alignment

2 subsystem (Windows GUI)

6.00 operating system version

10.00 image version

6.00 subsystem version

69D000 size of image

400 size of headers

69CE03 checksum

00100000 size of stack reserve

00001000 size of stack commit

00100000 size of heap reserve

00001000 size of heap commit

140  DLL characteristics

Dynamic base

NX compatible

9408 [     EDF] address [size] of Export Directory

64C7BC [      8C] address [size] of Import Directory

650000 [     504] address [size] of Resource Directory

0 [       0] address [size] of Exception Directory

697200 [    3E90] address [size] of Security Directory

651000 [   4B4E8] address [size] of Base Relocation Directory

639F44 [      54] address [size] of Debug Directory

0 [       0] address [size] of Description Directory

0 [       0] address [size] of Special Directory

0 [       0] address [size] of Thread Storage Directory

18A960 [      40] address [size] of Load Configuration Directory

0 [       0] address [size] of Bound Import Directory

64C000 [     7BC] address [size] of Import Address Table Directory

638E18 [     260] address [size] of Delay Import Directory

0 [       0] address [size] of COR20 Header Directory

0 [       0] address [size] of Reserved Directory

0:031> !dh -s 153a0000

SECTION HEADER #1

.text name

638FFB virtual size

1000 virtual address

639000 size of raw data

400 file pointer to raw data

0 file pointer to relocation table

0 file pointer to line numbers

0 number of relocations

0 number of line numbers

60000020 flags

Code

(no align specified)

Execute Read

Debug Directories(3)

Type       Size     Address  Pointer

cv           20      639f9c   63939c    Format: RSDS, guid, 2, clr.pdb

(    12)      14      1e4390   1e3790

(    10)       4      639f98   639398

SECTION HEADER #2

.data name

11E9E virtual size

63A000 virtual address

EE00 size of raw data

639400 file pointer to raw data

0 file pointer to relocation table

0 file pointer to line numbers

0 number of relocations

0 number of line numbers

C0000040 flags

Initialized Data

(no align specified)

Read Write

SECTION HEADER #3

.idata name

3224 virtual size

64C000 virtual address

3400 size of raw data

648200 file pointer to raw data

0 file pointer to relocation table

0 file pointer to line numbers

0 number of relocations

0 number of line numbers

C0000040 flags

Initialized Data

(no align specified)

Read Write

SECTION HEADER #4

.rsrc name

504 virtual size

650000 virtual address

600 size of raw data

64B600 file pointer to raw data

0 file pointer to relocation table

0 file pointer to line numbers

0 number of relocations

0 number of line numbers

40000040 flags

Initialized Data

(no align specified)

Read Only

SECTION HEADER #5

.reloc name

4B4E8 virtual size

651000 virtual address

4B600 size of raw data

64BC00 file pointer to raw data

0 file pointer to relocation table

0 file pointer to line numbers

0 number of relocations

0 number of line numbers

42000040 flags

Initialized Data

Discardable

(no align specified)

Read Only

0:031> !dh -a 153a0000

File Type: DLL

FILE HEADER VALUES

14C machine (i386)

5 number of sections

5348961E time date stamp Sat Apr 12 09:25:50 2014

0 file pointer to symbol table

0 number of symbols

E0 size of optional header

2122 characteristics

Executable

App can handle >2gb addresses

32 bit word machine

DLL

OPTIONAL HEADER VALUES

10B magic #

11.00 linker version

639000 size of code

5DE00 size of initialized data

0 size of uninitialized data

CD8F8 address of entry point

1000 base of code

----- new -----

0f2b0000 image base

1000 section alignment

200 file alignment

2 subsystem (Windows GUI)

6.00 operating system version

10.00 image version

6.00 subsystem version

69D000 size of image

400 size of headers

69CE03 checksum

00100000 size of stack reserve

00001000 size of stack commit

00100000 size of heap reserve

00001000 size of heap commit

140  DLL characteristics

Dynamic base

NX compatible

9408 [     EDF] address [size] of Export Directory

64C7BC [      8C] address [size] of Import Directory

650000 [     504] address [size] of Resource Directory

0 [       0] address [size] of Exception Directory

697200 [    3E90] address [size] of Security Directory

651000 [   4B4E8] address [size] of Base Relocation Directory

639F44 [      54] address [size] of Debug Directory

0 [       0] address [size] of Description Directory

0 [       0] address [size] of Special Directory

0 [       0] address [size] of Thread Storage Directory

18A960 [      40] address [size] of Load Configuration Directory

0 [       0] address [size] of Bound Import Directory

64C000 [     7BC] address [size] of Import Address Table Directory

638E18 [     260] address [size] of Delay Import Directory

0 [       0] address [size] of COR20 Header Directory

0 [       0] address [size] of Reserved Directory

SECTION HEADER #1

.text name

638FFB virtual size

1000 virtual address

639000 size of raw data

400 file pointer to raw data

0 file pointer to relocation table

0 file pointer to line numbers

0 number of relocations

0 number of line numbers

60000020 flags

Code

(no align specified)

Execute Read

Debug Directories(3)

Type       Size     Address  Pointer

cv           20      639f9c   63939c    Format: RSDS, guid, 2, clr.pdb

(    12)      14      1e4390   1e3790

(    10)       4      639f98   639398

SECTION HEADER #2

.data name

11E9E virtual size

63A000 virtual address

EE00 size of raw data

639400 file pointer to raw data

0 file pointer to relocation table

0 file pointer to line numbers

0 number of relocations

0 number of line numbers

C0000040 flags

Initialized Data

(no align specified)

Read Write

SECTION HEADER #3

.idata name

3224 virtual size

64C000 virtual address

3400 size of raw data

648200 file pointer to raw data

0 file pointer to relocation table

0 file pointer to line numbers

0 number of relocations

0 number of line numbers

C0000040 flags

Initialized Data

(no align specified)

Read Write

SECTION HEADER #4

.rsrc name

504 virtual size

650000 virtual address

600 size of raw data

64B600 file pointer to raw data

0 file pointer to relocation table

0 file pointer to line numbers

0 number of relocations

0 number of line numbers

40000040 flags

Initialized Data

(no align specified)

Read Only

SECTION HEADER #5

.reloc name

4B4E8 virtual size

651000 virtual address

4B600 size of raw data

64BC00 file pointer to raw data

0 file pointer to relocation table

0 file pointer to line numbers

0 number of relocations

0 number of line numbers

42000040 flags

Initialized Data

Discardable

(no align specified)

Read Only

_IMAGE_EXPORT_DIRECTORY 153a9408 (size: 00000edf)

Name: clr.dll

Characteristics: 00000000 Ordinal base: 22.

Number of Functions: 116. Number of names: 115. EAT: 153a9430.

ordinal hint target   name

33    0 15645AB2 AttachProfiler

34    1 15585AC2 CertCreateAuthenticodeLicense

35    2 1558591F CertFreeAuthenticodeSignerInfo

36    3 155858EC CertFreeAuthenticodeTimestamperInfo

37    4 1558597F CertTimestampAuthenticodeLicense

38    5 15585A11 CertVerifyAuthenticodeLicense

39    6 157DCC8A ClearDownloadCache

40    7 15507931 ClrCreateManagedInstance

41    8 1562CB25 CoEEShutDownCOM

42    9 1562862F CoInitializeCor

43   10 1562D1B6 CoInitializeEE

44   11 1562868F CoUninitializeCor

45   12 153B9C20 CoUninitializeEE

46   13 157EF53E CompareAssemblyIdentity

47   14 157EEBAA CompareAssemblyIdentityWithConfig

48   15 154E3B63 CopyPDBs

25   16 15550E29 CorDllMainForThunk

49   17 1562CCE4 CorExitProcess

50   18 1564772A CorLaunchApplication

51   19 1562868F CorMarkThreadInThreadPool

52   20 15585E81 CreateActContext

53   21 154A1369 CreateApplicationContext

54   22 157DDCC6 CreateAssemblyCache

55   23 157EE6A1 CreateAssemblyConfigCookie

56   24 157DFDDD CreateAssemblyEnum

57   25 153CFBED CreateAssemblyNameObject

58   26 15585E4E CreateCMSFromXml

59   27 156591AA CreateHistoryReader

60   28 157E0AB5 CreateInstallReferenceEnum

61   29 157DD635 DeleteShadowCache

62   30 157EE83E DestroyAssemblyConfigCookie

63   31 153BAEB8 DllCanUnloadNowInternal

64   32 15469450 DllGetActivationFactoryImpl

65   33 154C3F53 DllGetClassObjectInternal

66   34 153B94C8 DllRegisterServerInternal

67   35 153AB7B4 DllUnregisterServerInternal

68   36 1562E3B8 EEDllRegisterServer

69   37 1562E55B EEDllUnregisterServer

26   38 15638ACB GetAddrOfContractShutoffFlag

70   39 15585EAD GetAppIdAuthority

71   40 157F2840 GetAssemblyIdentityFromFile

72   41 1562858D GetAssemblyMDImport

27   42 154ABE09 GetCLRFunction

73   43 157F4F59 GetCLRIdentityManager

74   44 157E16F4 GetCachePath

28   45 15642F7D GetClassActivatorForApplicationImpl

75   46 158151C9 GetHashFromAssemblyFile

76   47 1581533A GetHashFromAssemblyFileW

77   48 1581571D GetHashFromBlob

78   49 1581544F GetHashFromFile

79   50 15815524 GetHashFromFileW

80   51 158155FE GetHashFromHandle

81   52 156591AA GetHistoryFileDirectory

82   53 154BBC81 GetIdentityAuthority

83   54 1540E2E4 GetMetaDataInternalInterface

84   55 1551F885 GetMetaDataInternalInterfaceFromPublic

85   56 154E325C GetMetaDataPublicInterfaceFromInternal

86   57 1565563B GetPermissionRequests

87   58 15452955 GetPrivateContextsPerfCounters

88   59 15585DE9 GetUserStateManager

89   60 15585DBB GetUserStore

90   61 154C02CF IEE

91   62 154BB26C InitializeFusion

92   63 153B94C8 InstallCustomModule

94   64 1581ACEA LegacyNGenCompile

95   65 1581AA2E LegacyNGenCreateZapper

96   66 1581ABB6 LegacyNGenFreeZapper

97   67 1581AC37 LegacyNGenTryEnumerateFusionCache

22   68 156286F3 LoadStringRC

98   69 156287A7 LoadStringRCEx

99   70 1562EB73 LogHelp_LogAssert

100   71 153AB7B4 LogHelp_NoGuiOnAssert

101   72 1546D4E0 LogHelp_TerminateOnAssert

102   73 15628B5E LookupHistoryAssembly

103   74 1551E842 MetaDataGetDispenser

104   75 15560890 NGenCreateNGenWorker

105   76 157DCC8A NukeDownloadedCache

106   77 15585E1C ParseManifest

107   78 157C93C4 PostErrorVA

108   79 157F185B PreBindAssembly

109   80 15470C12 PreBindAssemblyEx

23   81 1562844C ReOpenMetaDataWithMemory

110   82 156284EC ReOpenMetaDataWithMemoryEx

111   83 157E54BB SetMSIHandleForLogging

29   84 154BFEA3 SetRuntimeInfo

112   85 158131AA StrongNameCompareAssemblies

113   86 1581131F StrongNameErrorInfo

114   87 15411E50 StrongNameFreeBuffer

115   88 15812EF7 StrongNameGetBlob

116   89 1581304A StrongNameGetBlobFromImage

117   90 158119DB StrongNameGetPublicKey

118   91 15811A8C StrongNameGetPublicKeyEx

119   92 15813493 StrongNameHashSize

120   93 158118EA StrongNameKeyDelete

121   94 15811404 StrongNameKeyGen

122   95 15811521 StrongNameKeyGenEx

123   96 1581178C StrongNameKeyInstall

124   97 15811EA5 StrongNameSignatureGeneration

125   98 15812011 StrongNameSignatureGenerationEx

126   99 1581360A StrongNameSignatureSize

127  100 1555D6F6 StrongNameSignatureVerification

129  101 15812BFC StrongNameSignatureVerificationEx

128  102 15812AF2 StrongNameSignatureVerificationEx2

130  103 15812D38 StrongNameSignatureVerificationFromImage

131  104 158126A0 StrongNameTokenFromAssembly

132  105 1581274A StrongNameTokenFromAssemblyEx

133  106 15411AE6 StrongNameTokenFromPublicKey

134  107 15655578 TranslateSecurityAttributes

30  108 155855E5 _AxlGetIssuerPublicKeyHash

31  109 15585345 _AxlPublicKeyBlobToPublicKeyToken

32  110 155853B5 _AxlRSAKeyValueToPublicKeyToken

135  111 1562D24E _CorDllMain

137  112 15506B6A _CorExeMain

136  113 1562D619 _CorExeMain2

93  114 154C0E1C _IsOS@4

24      1564504A [NONAME]

_IMAGE_DELAYLOAD_DESCRIPTOR 159d8e18

mscoree.dll

00000001 Characteristics

159DE8CC Address of HMODULE

159DA000 Import Address Table

159D9288 Import Name Table

153A0000 Bound Import Name Table

153A0000 Unload Import Name Table

0 time date stamp

15562ED5    0 GetCORVersion

50317DD7    0 CreateConfigStream

503189EC    0 GetProcessExecutableHeap

5032AAA0    0 CLRCreateInstance

15562EC1    0 GetRequestedRuntimeInfo

15562ECB    0 CorBindToRuntime

_IMAGE_DELAYLOAD_DESCRIPTOR 159d8e38

ole32.dll

00000001 Characteristics

159DD548 Address of HMODULE

159DA01C Import Address Table

159D92A4 Import Name Table

153A0000 Bound Import Name Table

153A0000 Unload Import Name Table

0 time date stamp

158C0BDF    0 CLSIDFromString

158C0BD5    0 CoCreateInstanceFromApp

15524324    0 CoGetClassObject

158C0BCB    0 CoUnmarshalInterface

158C0BC1    0 CoMarshalInterface

158C0BB7    0 CoGetMarshalSizeMax

76ABEB18    0 CoGetContextToken

76AC621B    0 CoGetObjectContext

158C0BAD    0 CoCreateInstance

158C0BA3    0 CoReleaseMarshalData

158C0B99    0 CLSIDFromProgIDEx

158C0B8F    0 CLSIDFromProgID

155483D2    0 IIDFromString

158C0B85    0 StringFromGUID2

76AC08C5    0 CoInitializeEx

154C4D92    0 CoRegisterInitializeSpy

76A9607A    0 CoWaitForMultipleHandles

76AC85B3    0 CoUninitialize

158C0B7B    0 CoRevokeInitializeSpy

158C0B71    0 CreateStreamOnHGlobal

76AD7001    0 CoTaskMemFree

1546A8E9    0 CoCreateFreeThreadedMarshaler

76ACE98C    0 CoTaskMemAlloc

76AC1439    0 CoCreateGuid

158C0B67    0 CoRegisterClassObject

_IMAGE_DELAYLOAD_DESCRIPTOR 159d8e58

OLEAUT32.dll

00000001 Characteristics

159DD530 Address of HMODULE

159DA084 Import Address Table

159D930C Import Name Table

153A0000 Bound Import Name Table

153A0000 Unload Import Name Table

0 time date stamp

155270CA      Ordinal   183

158C0BF3      Ordinal   162

158C0C07      Ordinal    12

158C0C11      Ordinal   147

74E84D78      Ordinal   204

158C0C1B      Ordinal   180

15526E6F      Ordinal    16

15526CE2      Ordinal    17

15526CEC      Ordinal    20

158C0C25      Ordinal    19

158C0C2F      Ordinal    25

15562EE9      Ordinal   411

15562EF3      Ordinal    26

158C0C39      Ordinal   150

1551149A      Ordinal   149

74E63F30      Ordinal     9

158C0C43      Ordinal     8

158C0C4D      Ordinal    10

158C0C57      Ordinal   196

15528794      Ordinal   164

15526E8A      Ordinal    41

155270D4      Ordinal   323

155270DE      Ordinal    44

1552710C      Ordinal    37

158C0C6B      Ordinal    18

158C0C75      Ordinal    45

158C0C7F      Ordinal   202

158C0C89      Ordinal    24

158C0C93      Ordinal    23

74EAE4DA      Ordinal   220

74EAE965      Ordinal   216

74E96359      Ordinal   188

74E84C46      Ordinal   194

74E95B52      Ordinal   179

158C0CC5      Ordinal   193

74E83F38      Ordinal   203

158C0CD9      Ordinal   187

158C0BE9      Ordinal   201

158C0BFD      Ordinal   200

154D056C      Ordinal     7

1550FF9B      Ordinal     4

154D0562      Ordinal     6

158C0C61      Ordinal   228

15562EDF      Ordinal     2

15526CF6      Ordinal    77

_IMAGE_DELAYLOAD_DESCRIPTOR 159d8e78

WINTRUST.dll

00000001 Characteristics

159E90F8 Address of HMODULE

159DA13C Import Address Table

159D93C4 Import Name Table

153A0000 Bound Import Name Table

153A0000 Unload Import Name Table

0 time date stamp

158C0CE3    0 WinVerifyTrust

_IMAGE_DELAYLOAD_DESCRIPTOR 159d8e98

CRYPT32.dll

00000001 Characteristics

159DE860 Address of HMODULE

159DA144 Import Address Table

159D93CC Import Name Table

153A0000 Bound Import Name Table

153A0000 Unload Import Name Table

0 time date stamp

158C0D19    0 CryptEncodeObject

15562F07    0 CertOpenStore

158C0CFB    0 CertFindCertificateInStore

15562EFD    0 CertCloseStore

158C0DFF    0 CertSetCertificateContextProperty

158C0DF5    0 CertSaveStore

158C0DEB    0 CertSerializeCertificateStoreElement

15562F25    0 CertAddCertificateLinkToStore

158C0DE1    0 PFXImportCertStore

15562F1B    0 CryptQueryObject

158C0DD7    0 CryptFindOIDInfo

158C0DCD    0 PFXExportCertStore

158C0DC3    0 CertGetSubjectCertificateFromStore

158C0DB9    0 CryptMsgControl

158C0DAF    0 CertVerifyCertificateChainPolicy

15562F11    0 CertEnumCertificatesInStore

158C0DA5    0 CertCreateCertificateContext

158C0D9B    0 CertAddCertificateContextToStore

158C0D91    0 CryptMsgOpenToDecode

154D6751    0 CertDuplicateCertificateContext

158C0D87    0 CryptMsgUpdate

158C0D7D    0 CryptMsgClose

158C0D73    0 CryptHashCertificate

158C0D69    0 CryptImportPublicKeyInfo

158C0D5F    0 CertGetEnhancedKeyUsage

158C0D55    0 CertOIDToAlgId

158C0D4B    0 CertFindAttribute

158C0D41    0 CryptMsgGetParam

158C0D37    0 CertGetNameStringW

158C0D2D    0 CertGetCertificateChain

158C0D23    0 CertFreeCertificateChain

154D675F    0 CertFreeCertificateContext

158C0D05    0 CryptDecodeObject

158C0D0F    0 CertFindExtension

154D6758    0 CertGetCertificateContextProperty

_IMAGE_DELAYLOAD_DESCRIPTOR 159d8eb8

urlmon.dll

00000001 Characteristics

159E1D38 Address of HMODULE

159DA1D4 Import Address Table

159D945C Import Name Table

153A0000 Bound Import Name Table

153A0000 Unload Import Name Table

0 time date stamp

158C0E09    0 CopyBindInfo

158C0E13    0 CoInternetGetSession

75C74629    0 CoInternetCreateSecurityManager

_IMAGE_DELAYLOAD_DESCRIPTOR 159d8ed8

bcrypt.dll

00000001 Characteristics

159E90FC Address of HMODULE

159DA1E4 Import Address Table

159D946C Import Name Table

153A0000 Bound Import Name Table

153A0000 Unload Import Name Table

0 time date stamp

158C0E43    0 BCryptHashData

158C0E3C    0 BCryptCreateHash

158C0E51    0 BCryptDestroyHash

158C0E1D    0 BCryptOpenAlgorithmProvider

158C0E4A    0 BCryptFinishHash

158C0E35    0 BCryptGetProperty

158C0E58    0 BCryptCloseAlgorithmProvider

_IMAGE_DELAYLOAD_DESCRIPTOR 159d8ef8

api-ms-win-core-winrt-string-l1-1-0.dll

00000001 Characteristics

159DE8C8 Address of HMODULE

159DA204 Import Address Table

159D948C Import Name Table

153A0000 Bound Import Name Table

153A0000 Unload Import Name Table

0 time date stamp

154C4CA0    0 WindowsCreateStringReference

158C0E73    0 WindowsDuplicateString

158C0E69    0 WindowsCompareStringOrdinal

154C652E    0 WindowsDeleteString

154C8A94    0 WindowsGetStringLen

158C0E5F    0 WindowsIsStringEmpty

154C6524    0 WindowsGetStringRawBuffer

154A914A    0 WindowsCreateString

_IMAGE_DELAYLOAD_DESCRIPTOR 159d8f18

api-ms-win-core-winrt-l1-1-0.dll

00000001 Characteristics

159DE8E0 Address of HMODULE

159DA228 Import Address Table

159D94B0 Import Name Table

153A0000 Bound Import Name Table

153A0000 Unload Import Name Table

0 time date stamp

154C4CAA    0 RoGetActivationFactory

154ABD81    0 RoInitialize

154ABD7A    0 RoUninitialize

_IMAGE_DELAYLOAD_DESCRIPTOR 159d8f38

api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll

00000001 Characteristics

159DE8C4 Address of HMODULE

159DA238 Import Address Table

159D94C0 Import Name Table

153A0000 Bound Import Name Table

153A0000 Unload Import Name Table

0 time date stamp

154A9121    0 RoGetParameterizedTypeInstanceIID

_IMAGE_DELAYLOAD_DESCRIPTOR 159d8f58

api-ms-win-ro-typeresolution-l1-1-0.dll

00000001 Characteristics

159DF7C8 Address of HMODULE

159DA240 Import Address Table

159D94C8 Import Name Table

153A0000 Bound Import Name Table

153A0000 Unload Import Name Table

0 time date stamp

1546841B    0 RoParseTypeName

_IMAGE_DELAYLOAD_DESCRIPTOR 159d8f78

Cabinet.dll

00000001 Characteristics

159E9100 Address of HMODULE

159DA248 Import Address Table

159D94D0 Import Name Table

153A0000 Bound Import Name Table

153A0000 Unload Import Name Table

0 time date stamp

158C0E7D      Ordinal    23

158C0E95      Ordinal    22

158C0E9C      Ordinal    20

_IMAGE_DELAYLOAD_DESCRIPTOR 159d8f98

WININET.dll

00000001 Characteristics

159E9104 Address of HMODULE

159DA258 Import Address Table

159D94E0 Import Name Table

153A0000 Bound Import Name Table

153A0000 Unload Import Name Table

0 time date stamp

158C0ED0    0 InternetReadFile

158C0EEC    0 InternetConnectA

158C0EF3    0 InternetOpenA

158C0EC9    0 InternetCloseHandle

158C0EC2    0 InternetTimeToSystemTimeA

158C0EE5    0 HttpOpenRequestA

158C0ED7    0 HttpQueryInfoA

158C0EBB    0 CreateUrlCacheEntryW

158C0EA3    0 CommitUrlCacheEntryW

158C0EDE    0 HttpSendRequestA

_IMAGE_DELAYLOAD_DESCRIPTOR 159d8fb8

MPR.dll

00000001 Characteristics

159E9108 Address of HMODULE

159DA284 Import Address Table

159D950C Import Name Table

153A0000 Bound Import Name Table

153A0000 Unload Import Name Table

0 time date stamp

158C0EFA    0 WNetGetConnectionW

_IMAGE_DELAYLOAD_DESCRIPTOR 159d8fd8

VERSION.dll

00000001 Characteristics

159DA360 Address of HMODULE

159DA28C Import Address Table

159D9514 Import Name Table

153A0000 Bound Import Name Table

153A0000 Unload Import Name Table

0 time date stamp

73646DBD    0 GetFileVersionInfoSizeW

739619F4    0 GetFileVersionInfoW

73961B51    0 VerQueryValueW

_IMAGE_DELAYLOAD_DESCRIPTOR 159d8ff8

WTSAPI32.dll

00000001 Characteristics

159E9114 Address of HMODULE

159DA29C Import Address Table

159D9524 Import Name Table

153A0000 Bound Import Name Table

153A0000 Unload Import Name Table

0 time date stamp

158C0F12    0 WTSEnumerateProcessesW

158C0F2A    0 WTSFreeMemory

_IMAGE_DELAYLOAD_DESCRIPTOR 159d9018

RstrtMgr.DLL

00000001 Characteristics

159E9118 Address of HMODULE

159DA2A8 Import Address Table

159D9530 Import Name Table

153A0000 Bound Import Name Table

153A0000 Unload Import Name Table

0 time date stamp

158C0F50    0 RmEndSession

158C0F49    0 RmGetList

158C0F57    0 RmStartSession

158C0F31    0 RmRegisterResources

_IMAGE_DELAYLOAD_DESCRIPTOR 159d9038

msi.dll

00000001 Characteristics

159E911C Address of HMODULE

159DA2BC Import Address Table

159D9544 Import Name Table

153A0000 Bound Import Name Table

153A0000 Unload Import Name Table

0 time date stamp

158C0F7D      Ordinal     8

158C0F76      Ordinal   125

158C0F5E      Ordinal    17

158C0F84      Ordinal   103

_IMAGE_IMPORT_DESCRIPTOR 159ec7bc

KERNEL32.dll

159EC000 Import Address Table

159EC8A4 Import Name Table

0 time date stamp

0 Index of first forwarder reference

76113C20  26E GetLocaleInfoW

76139EE9  164 EnumTimeFormatsW

76194A3F  144 EnumCalendarInfoExW

76132C52  2E9 GetSystemDefaultUILanguage

76133607  22D GetDateFormatW

7611482B  3C3 LoadLibraryW

761210B5  28E GetNativeSystemInfo

7611CB3A  431 QueryActCtxW

7361258F   EF CreateProcessW

76115EDE  19B FindNextFileW

76113413  241 GetEnvironmentVariableA

761152A1  3D8 LockResource

76115A51  55E SizeofResource

76115294  3C6 LoadResource

761127E9  1A3 FindResourceExW

7612EC91  311 GetTickCount64

7611192E  392 IsWow64Process

76114451  32E GetWindowsDirectoryW

76115EB1  495 ReleaseActCtx

76115E4C  110 DeactivateActCtx

76115E80    3 ActivateActCtx

7611925F   BC CreateActCtxW

7612D555  1D7 GetCalendarInfoW

76114F63  2EB GetSystemDirectoryW

761144A4  18F FindFirstFileW

77383A9C  3B1 LCMapStringW

7611176C  1BE GetACP

76111718  381 IsDBCSLeadByte

76115089  1CD GetCPInfo

761B7139  4EA SetConsoleTitleW

761B73E6   16 AllocConsole

761B7368  1B5 FreeConsole

7613BC1E  2FF GetTempFileNameW

7612D4FC  301 GetTempPathW

7613B36F  53D SetThreadIdealProcessor

7612FDE8  538 SetThreadAffinityMask

77034D21  225 GetCurrentProcessorNumber

77391DB4  3E5 MoveFileExW

77391CCF  3E8 MoveFileW

76115BAB  1AD FlushFileBuffers

76111AF5   A3 CompareFileTime

76114476  256 GetFileTime

7619EDC9  4B0 ResetWriteWatch

7619ED90  32F GetWriteWatch

7611D337   E1 CreateMemoryResourceNotification

7613B357  414 OutputDebugStringA

7612CFF4  45B ReadProcessMemory

7612D3E3  2D0 GetQueuedCompletionStatus

7612F11B  41F PostQueuedCompletionStatus

77383815   A7 CompareStringW

7611451A  31D GetUserDefaultUILanguage

76FFB29F  13C EncodePointer

76FF9675  117 DecodePointer

761118C1  3DB MapViewOfFile

76194D1F  4A1 RemoveDirectoryW

7612F015  50C SetFileTime

761152B9  1A4 FindResourceW

73646CD0   B9 CopyFileW

76136544  5F7 WritePrivateProfileStringW

7611277F  12D DeviceIoControl

76115A2E  26B GetLocalTime

7612C888  326 GetVolumeInformationW

77392146  503 SetFileAttributesW

7612E8A9  134 DosDateTimeToFileTime

7613BF76  3CB LocalFileTimeToFileTime

73646BDA   CE CreateFileA

761159D3  61C lstrlenA

76132C3A  32D GetWindowsDirectoryA

76194B8F  232 GetDiskFreeSpaceA

76131B0B  315 GetTimeFormatW

7613C479  1B0 FlushViewOfFile

73624CDE  322 GetVersionExA

761148D7  3C0 LoadLibraryA

7611165C  3C9 LocalAlloc

2AE79832  354 HeapReAlloc

77391BB0  120 DeleteFileA

73646C96   B4 CopyFileA

76115E04  249 GetFileAttributesA

773920EE  500 SetFileAttributesA

7613BF8E   C1 CreateDirectoryA

76194D0F  49E RemoveDirectoryA

76114813  3C1 LoadLibraryExA

7611E2CE  188 FindFirstFileA

7613BFA6  199 FindNextFileA

73624C4E  321 GetVersion

76111454  36B InterlockedCompareExchange

7613BC09  2A0 GetOEMCP

76194921   2C AreFileApisANSI

7611E2C1  25F GetFullPathNameA

7612CE56  4F6 SetEndOfFile

7612B694  2EA GetSystemDirectoryA

76111432  36E InterlockedExchange

7619DE78   DA CreateHardLinkW

7612CF50  521 SetPriorityClass

7612C82F  509 SetFilePointerEx

76111916  2E2 GetStringTypeW

7613B73C  382 IsDBCSLeadByteEx

770123B9  16E ExitThread

7611173B  400 OpenFileMappingW

7612CD98  4BF SearchPathW

7612CE6E  38F IsValidLocale

76115B6A  317 GetTimeZoneInformation

761AC3EB  283 GetNLSVersionEx

7612A9BE  212 GetConsoleTitleW

73624D95  323 GetVersionExW

7611532A  255 GetFileSizeEx

761118FE  3EC MultiByteToWideChar

76115B31  1B4 FormatMessageW

76117A28  16D ExitProcess

7611485D  3C2 LoadLibraryExW

76114850  27D GetModuleFileNameW

7611496F  280 GetModuleHandleExW

761144B1  184 FindClose

761111C0  26A GetLastError

761124AF  281 GetModuleHandleW

761117D9  223 GetCurrentProcess

73646C6A   8E CloseHandle

76111136  5BB WaitForSingleObject

7611111E  497 ReleaseMutex

76111695  4FC SetEvent

7612D3CB  49B ReleaseSemaphore

7611196E  5BA WaitForMultipleObjectsEx

761142BB   E5 CreateMutexW

7611180E   CA CreateEventW

7612CA82   F5 CreateSemaphoreW

76112F3C  3CD LocalFree

761111F8  224 GetCurrentProcessId

76111956  408 OpenProcess

6E07FFF6  2B5 GetProcAddress

76111275  42B ProcessIdToSessionId

76111420  228 GetCurrentThreadId

7611110C  310 GetTickCount

76118A21  4CF SetConsoleCtrlHandler

76194A05  114 DebugBreak

761124D4  101 CreateThread

761111A9  517 SetLastError

76115123  1E3 GetCommandLineW

76116001  21D GetCurrentDirectoryW

761116D0  61D lstrlenW

761141EC  262 GetFullPathNameW

7611D2F9  2D5 GetShortPathNameW

7611A2F1  277 GetLongPathNameW

761148CA  2EE GetSystemInfo

761111E0  583 TlsGetValue

7612D61D  31B GetUserDefaultLangID

76111B18  242 GetEnvironmentVariableW

76118A09  4FA SetEnvironmentVariableW

7613B6F2  2BC GetProcessId

7612CCA1  2A1 GetOverlappedResult

7618C321   79 CancelIo

761114B9  2BA GetProcessHeap

76111499  351 HeapFree

76FF3F1F  373 InterlockedPushEntrySList

76111282  5F1 WriteFile

761150B3  2DD GetStdHandle

761116DD  5DD WideCharToMultiByte

76129B37  20C GetConsoleOutputCP

76115D9E  250 GetFileInformationByHandle

76111AE8  24E GetFileAttributesW

761142C8   C6 CreateDirectoryW

761117BC  227 GetCurrentThread

76194FB1  272 GetLogicalProcessorInformation

7611A849  2B6 GetProcessAffinityMask

7619378C  522 SetProcessAffinityMask

761189F1  540 SetThreadLocale

76114B83  3DC MapViewOfFileEx

761144C9  5B3 VirtualQuery

761117F6  593 UnmapViewOfFile

76111AD0  4FB SetErrorMode

761124C7  1B8 FreeLibrary

7612D5A2  1B9 FreeLibraryAndExitThread

7611495D  383 IsDebuggerPresent

761151EE  448 RaiseException

76FE0B9C  1AF FlushProcessWriteBuffers

761116F5  43C QueryPerformanceCounter

76115F76  2E1 GetStringTypeExW

761118D9   D3 CreateFileMappingW

7611193E  254 GetFileSize

7613BF2C  342 GlobalMemoryStatusEx

761114CB  584 TlsSetValue

76111245  27E GetModuleHandleA

761148AD  581 TlsAlloc

76112586  582 TlsFree

2AE792CD  34D HeapAlloc

76114402  1AE FlushInstructionCache

7613747F  10A CreateToolhelp32Snapshot

76138CDB  428 Process32FirstW

76138A32  42A Process32NextW

73646C22   D6 CreateFileW

76194E2F  5C2 WaitNamedPipeW

76194D8F  520 SetNamedPipeHandleState

761115A6  3FC OpenEventW

76194DCF  586 TransactNamedPipe

76111826  5AB VirtualAlloc

7611183E  5AE VirtualFree

761143CE  5B1 VirtualProtect

7611492D  34F HeapCreate

761125B6  350 HeapDestroy

7612B1A3  359 HeapValidate

76111215  562 SleepEx

7612F1DE  56A SwitchToThread

761150E3  240 GetEnvironmentStringsW

761150CB  1B7 FreeEnvironmentStringsW

76111856  139 DuplicateHandle

76139FEE  446 QueueUserAPC

76111151  5BC WaitForSingleObjectEx

7611280B  542 SetThreadPriority

7611442E  30B GetThreadPriority

76137AF4  302 GetThreadContext

76137E9E  568 SuspendThread

7611445E  4B5 ResumeThread

76195BE3  539 SetThreadContext

76131F2E  55D SignalObjectAndWait

761110FF  55F Sleep

7611D31F  544 SetThreadStackGuarantee

761134D4  38A IsThreadAFiber

76112644  43D QueryPerformanceFrequency

76195C3B  30E GetThreadTimes

761117A1  508 SetFilePointer

76113FE5  458 ReadFile

761145E3  24B GetFileAttributesExW

7612D822  56F TerminateProcess

7613784F  590 UnhandledExceptionFilter

77034141   14 AddVectoredExceptionHandler

77033F00  4A7 RemoveVectoredExceptionHandler

76115135  388 IsProcessorFeaturePresent

7612D443  5AA VerifyVersionInfoW

7613BC3C  415 OutputDebugStringW

76FF4320  365 InitializeCriticalSection

76FF3DBD  11E DeleteCriticalSection

76FF2600  58A TryEnterCriticalSection

76FE22C0  140 EnterCriticalSection

76FE2280  3BD LeaveCriticalSection

7612D62F  2C4 GetProcessTimes

76115A1E  2F2 GetSystemTime

76115A06  56B SystemTimeToFileTime

76112508  2F4 GetSystemTimeAsFileTime

7612EC2F  105 CreateThreadpoolTimer

7700F78C  54A SetThreadpoolTimer

761116AD  4AE ResetEvent

76195071  41E PeekNamedPipe

76FF3F38  372 InterlockedPopEntrySList

761125CE  309 GetThreadLocale

77391C05  123 DeleteFileW

76FF8DF4  369 InitializeSListHead

76FF2875  370 InterlockedFlushSList

761142A3  239 GetDriveTypeW

7702A739   9B CloseThreadpoolTimer

76132AB8  2AC GetPrivateProfileIntW

76194A2F  131 DisconnectNamedPipe

7619499B   E7 CreateNamedPipeW

7619494B   A8 ConnectNamedPipe

761127F9  2E6 GetSystemDefaultLCID

76113D83  31A GetUserDefaultLCID

7612ECA3   DB CreateIoCompletionPort

_IMAGE_IMPORT_DESCRIPTOR 159ec7d0

MSVCR120_CLR0400.dll

159EC400 Import Address Table

159ECCA4 Import Name Table

0 time date stamp

0 Index of first forwarder reference

0FDE0CB8  1B5 __iob_func

0FDE5296  176 __CxxFrameHandler3

0FDF5F80  15D _CxxThrowException

0FDD4799  159 _CItanh

0FDD4788  156 _CIsinh

0FDC83C0  154 _CIpow

0FDDB8B0  153 _CIlog10

0FDDC580  152 _CIlog

0FDC3C1A  151 _CIfmod

0FDD557C  150 _CIexp

0FDD4792  14F _CIcosh

0FDD9A80  14B _CIasin

0FDD7C40  14A _CIacos

0FDE119E  68C wcscpy_s

0FDE93EE  5CE fclose

0FE2AFB2  5EE fwrite

0FE29D25  5DA fopen_s

0FDE0C3A  34B _isnan

0FE2DFD5  681 vswprintf_s

0FDE7DCC  667 strtoul

0FE2BFAF  468 _snprintf

0FDC1000  62B memset

0FDE14B5  61C malloc

0FDF567F  604 isupper

0FDE4020  612 isxdigit

0FE3459F  60A iswdigit

0FE345C1  611 iswxdigit

0FDE258A  6A7 wmemcpy_s

0FDE98D2  577 _wmakepath_s

0FDE81B8  599 _wsplitpath_s

0FDE25CD  697 wcsrchr

0FDDEEC7  687 wcscat_s

0FDDEE51  694 wcsncpy_s

0FDE21BF  50F _vsnwprintf

0FDE159B  499 _stricmp

0FDC1350  627 memcpy

0FDE366F  669 swprintf_s

0FE5E8B8  430 _purecall

0FE22617  362 _itow_s

0FDC2320  658 strlen

0FDC2240  650 strcmp

0FDE57AA  531 _wcsicmp

0FDE5104  26F _except_handler4_common

0FDF6001  18E __clean_type_info_names_internal

0FE50F3D  13B ?terminate@@YAXXZ

0FDE6065  421 _onexit

0FDE4294  1AB __dllonexit

0FDE0468  22A _calloc_crt

0FDE027E  4E5 _unlock

0FDE0259  37B _lock

0FE5EB9D  1A8 __crtTerminateProcess

0FE5EBB2  1A9 __crtUnhandledException

0FE62D22  24A _crt_debugger_hook

0FDD5DDB   70 ??1type_info@@UAE@XZ

0FDE4354  2FE _initterm_e

0FDE4376  2FD _initterm

0FDE4263  38C _malloc_crt

0FDDEE2D  5E3 free

0FE1F8DA  214 _amsg_exit

0FE5F9D4  171 __CppXcptFilter

0FDF3F75  5C0 bsearch

0FDF4083  69E wcstok_s

0FDE1A53  65A strncat_s

0FE2BA39  438 _putws

0FDF50A9  292 _flushall

0FE2E75B  6A9 wprintf

0FE2AD97  5EC fwprintf

0FDE149D  60F iswspace

0FE2DF42  51B _vswprintf_p

0FDE3600  511 _vsnwprintf_s

0FDE58E4  50D _vsnprintf_s

0FDE4452  53B _wcsnicmp

0FE22640  389 _ltow_s

0FDE4F7A  4C9 _time64

0FE2E312  56C _wfopen

0FDDEF56  695 wcsnlen

0FDC19C0  625 memchr

0FE21CEF  5BE atoi

0FDE0C76  692 wcsncmp

0FE34258  5FB isalpha

0FDC3900  5D7 floor

0FDE7F83  5D1 fflush

0FDC3780  5C4 ceil

0FE7B47F  23F _copysign

0FDC3A80  62C modf

0FDE158A  676 towupper

0FDE3F87  66B swscanf_s

0FDE55CF  675 towlower

0FDE55E0  610 iswupper

0FDF4051  5A8 _wtoi

0FDE1248  688 wcschr

0FE35F5D  674 toupper

0FE345E9  607 iswascii

0FE3032F  691 wcsncat_s

0FE2C6FE  474 _snwprintf_s

0FE2B701  62F printf

0FDC2740  660 strrchr

0FDE1181  26C _errno

0FDE2DA9  64C sscanf_s

0FDE254E  5FD isdigit

0FDE4D4B  4A3 _strnicmp

0FE2FE05  65E strnlen

0FDE4EF9  6A2 wcstoul

0FE21CF5  5BF atol

0FDE0B93  65D strncpy_s

0FE2FE20  64E strcat_s

0FDF3E42  69B wcsstr

0FE4ED32  537 _wcslwr_s

0FDE4A17  648 sprintf_s

0FDE0F79  628 memcpy_s

0FDE0AC8  653 strcpy_s

0FDC24F0  65B strncmp

0FE29DD1  5DB fprintf

0FDC1AD0  629 memmove

0FDE0FB9  636 qsort

0FDE092D  23E _controlfp_s

0FE2DA47  509 _vsnprintf

0FDD5CB0  64F strchr

0FDE0965  626 memcmp

_IMAGE_IMPORT_DESCRIPTOR 159ec7e4

ntdll.dll

159EC5E0 Import Address Table

159ECE84 Import Name Table

0 time date stamp

0 Index of first forwarder reference

76FF645D  45E RtlNtStatusToDosError

7702577E  5CE VerSetConditionMask

77023721  536 RtlUnwind

77023513  2AD RtlCaptureContext

_IMAGE_IMPORT_DESCRIPTOR 159ec7f8

USER32.dll

159EC5F4 Import Address Table

159ECE98 Import Name Table

0 time date stamp

0 Index of first forwarder reference

74C66F69  376 wsprintfW

74C60A61  138 GetDesktopWindow

74C57819  33B TranslateMessage

74C60602  26A PeekMessageW

74C608DC  253 MsgWaitForMultipleObjectsEx

74C5788B   B6 DispatchMessageW

74C58EC9  22F LoadStringW

74C59EFA  192 GetProcessWindowStation

74C58078  1B7 GetUserObjectInformationW

74C62BC6  1E1 InSendMessage

74C60E36  142 GetFocus

_IMAGE_IMPORT_DESCRIPTOR 159ec80c

SHLWAPI.dll

159EC624 Import Address Table

159ECEC8 Import Name Table

0 time date stamp

0 Index of first forwarder reference

74DE6763  172 UrlIsW

74DE66B7  174 UrlUnescapeW

74DE8277  12C StrCmpW

74DE6CE1   47 PathCreateFromUrlW

74DE7472  15D UrlCanonicalizeW

74DEC177   34 PathAddBackslashW

74DE55BF   78 PathIsURLW

74DE75FB  15F UrlCombineW

74DDE52D  151 StrStrW

74DE80B4  16A UrlGetPartW

74DE3EF0  142 StrRChrW

74DE3248   90 PathRemoveFileSpecW

74DE1C53   8E PathRemoveExtensionW

74DE50BE  157 StrToIntW

74DE5CC4  12B StrCmpNW

74DE4640  11D StrChrW

74DEBFA2   6A PathIsRelativeW

74DEA1B9   4C PathFindExtensionW

74DE5C62   8A PathRemoveBackslashW

74DEC39C   3E PathCombineW

74DEBB71   4E PathFindFileNameW

74DDE3AF   3C PathCanonicalizeW

74DEA197   76 PathIsUNCW

74DE8CA7  165 UrlEscapeW

_IMAGE_IMPORT_DESCRIPTOR 159ec820

ADVAPI32.dll

159EC688 Import Address Table

159ECF2C Import Name Table

0 time date stamp

0 Index of first forwarder reference

74B6771B   CA CryptEncrypt

74B834E4   D3 CryptGetDefaultProviderW

74B67733   DD CryptSetKeyParam

74B83464   C5 CryptDeriveKey

74B83534   DE CryptSetProvParam

74B5421C   E9 DeleteAce

74B835A4   E5 CryptVerifySignatureA

74B83524   DC CryptSetHashParam

74B52E1F  19C IsValidSid

74B4A89D  169 GetSidIdentifierAuthority

74B834B4   CD CryptEnumProvidersA

7361DB31  295 RegQueryValueExA

773926E3  260 RegCreateKeyExA

74B54752   92 CreateWellKnownSid

74B5458D   11 AddAccessAllowedAceEx

74B4C4B2   E6 CryptVerifySignatureW

74B547A8  1A7 LookupAccountSidW

73620A45  28F RegQueryInfoKeyA

74B834F4   D6 CryptGetProvParam

74B834C4   CE CryptEnumProvidersW

74B83594   E4 CryptSignHashW

74B6774B   D5 CryptGetKeyParam

74B83504   D7 CryptGetUserKey

74B4C49A   DA CryptImportKey

74B4C482   C7 CryptDestroyKey

74B49150   CF CryptExportKey

74B48E51   D0 CryptGenKey

74B4F46B  156 GetNamedSecurityInfoW

77392EC1  270 RegDeleteValueW

74B49143   C0 CryptAcquireContextA

74B4DE9E   D8 CryptHashData

74B4DECE   C6 CryptDestroyHash

74B4DEB6   C3 CryptCreateHash

74B4DEE6   D4 CryptGetHashParam

74B5437E   85 CopySid

74B4C74E   EE DuplicateToken

74B4C7A1  2BB ReportEventW

74B5350D   EB DeregisterEventSource

74B5264C  2AB RegisterEventSourceW

74B50D3F  16C GetSidSubAuthorityCount

74B50D57  16B GetSidSubAuthority

77392D6F  2A6 RegSetValueExW

73620317  27A RegEnumValueW

7361F236  26C RegDeleteKeyW

773927F1  261 RegCreateKeyExW

74B540A6   10 AddAccessAllowedAce

74B5406B  14A GetLengthSid

736203FF  290 RegQueryInfoKeyW

7361D514  297 RegQueryValueW

773929D5  289 RegOpenKeyExW

74B4E08C   DB CryptReleaseContext

74B4DF30   D1 CryptGenRandom

74B4DE7C   C1 CryptAcquireContextW

77002895  120 EventRegister

74B4C4E2  189 ImpersonateLoggedOnUser

74B4C736  2EE SetThreadToken

74B51492  2BC RevertToSelf

74B54520  136 GetAce

74B544FD  18C InitializeAcl

74B540D6  15C GetSecurityDescriptorDacl

74B54575  2DA SetKernelObjectSecurity

7361D55F  296 RegQueryValueExW

7362036A  277 RegEnumKeyExW

7361DB7E  258 RegCloseKey

74B5425C  217 OpenThreadToken

74B51E89   81 ConvertStringSecurityDescriptorToSecurityDescriptorW

74B54274   7B ConvertSidToStringSidW

7701977D  123 EventWrite

74B5405E  133 FreeSid

74B5408E  2E3 SetSecurityDescriptorDacl

74B54550  18D InitializeSecurityDescriptor

74B52996  2D3 SetEntriesInAclW

74B54016   20 AllocateAndInitializeSid

74B5424C  16F GetTokenInformation

74B54234  212 OpenProcessToken

74B83454   C4 CryptDecrypt